Nigeria NDPA vs South Africa POPIA: Pan-African Compliance

Officer design: NDPA requires DPOs for major-importance controllers, a GDPR-style appointment; POPIA defaults the information officer to the CEO with registration and personal accountability. Supervision: Nigeria runs annual third-party (DPCO) audit returns; South Africa runs prior authorization for listed processing and complaint-driven enforcement. Fines: Nigeria scales to 2% of gross revenue; South Africa caps at R10 million but adds imprisonment-backed offenses. Scope: POPIA covers companies' information; NDPA does not. Marketing: POPIA's Section 69 opt-in is stricter and more actively enforced; the NDPA handles marketing through objection rights and consent discipline. Both regulate transfers on adequacy-or-safeguards logic.

Both are extraterritorial, differently. The NDPA covers foreign controllers processing personal data of data subjects in Nigeria, and its major-importance classification can pull large foreign platforms into registration, DPO, and audit-return duties, the NDPC and FCCPC actions against Meta (the FCCPC's USD 220 million penalty was upheld on appeal in 2025) show enforcement follows. POPIA applies to foreign parties only when they use means (automated or otherwise) located in South Africa beyond mere transit, a narrower hook, but once in scope the full statute applies, including the information officer duty. Foreign SaaS with African customers usually lands in NDPA scope more readily than POPIA scope.

Build to the stricter rule: opt-in. POPIA Section 69 requires consent for electronic direct marketing with a tightly fenced existing-customer exception (details collected in a sale context, similar products, opt-out at collection and per message, consent requestable only once), and it is the Information Regulator's most active complaint category. The NDPA reaches marketing through consent requirements, objection rights, and NDPC guidance on lending-app and telemarketing abuses. A single opt-in consent flow with per-country records, plus honoring objections instantly, satisfies both and simplifies audits, DPCO auditors in Nigeria and Regulator investigators in South Africa both start with marketing evidence because it is externally visible.

Same architecture, different maturity. NDPA: criteria-based adequacy (enforceable rights, remedies, comparable protection) that the NDPC can determine, plus safeguards (contractual instruments, BCR-like mechanisms) and derogations including informed consent; the instrument set is still maturing, so per-corridor safeguard memos are the practical default. POPIA Section 72: transfers allowed where the recipient is bound by law or binding corporate rules/agreements providing substantially similar protection (including further-transfer limits), or with consent, contract necessity, or benefit grounds; no official adequacy list exists, so the binding-agreement route dominates. Both regimes reward one artifact: a per-flow transfer register with justification and instrument.

A GDPR-grade core (inventory, bases, security, DSAR pipeline, breach response, processor contracts) plus thin country annexes. Nigeria annex: major-importance analysis, NDPC registration, DPO, DPCO engagement with audit calendar, NDPA transfer memos. South Africa annex: information officer registration and delegation instrument, PAIA manual, juristic-person scope extension, Section 69 marketing mechanics, Section 57 prior-authorization check, Section 72 transfer agreements. Add Kenya (ODPC registration) and other jurisdictions as annexes on the same chassis. The failure mode to avoid is per-country silos: African regulators increasingly cooperate (through the Network of African Data Protection Authorities), and inconsistent filings across countries are discoverable.